Is it safe to change passwords and profile of the user by default DB?

Version of the grid: 11.2.0.4.0

RDBMS version: 11.2.0.4.0

Platform: Oracle Linux 6.4

To comply with upcoming security audit, we need all DB users except users of the application to conform to the password of our firm strategy.

Currently, all of our DB users belong to the DEFAULT profile which is not to impose restrictions such as the complexity of password, password expiration.

To implement password policy, I created 3 profiles and a password check the operation.

Here are the 3 profiles, that I introduce

MANH_ADM - for SYS, SYSTEM, SYSMAN users. Associated with a password check function that responds to the lack of policies of our firm.

MANH_NONADM - for users who were created by default when you create a new database. Associated with a password check the operation comply with the policies of our firm

MANH_APP - users for the Application. Very mild. No restrictions as requested by the team of apps. No associated password policy.

Here is an excerpt of the script we used to implement all our DBs It Security.

change the profile of these users to a custom profile named MANH_NONADM and changes the password for all users by default DB.

ALTER USER OUTLN PROFILE MANH_NONADM;

ALTER USER PROFILE MANH_NONADM DIP.

ALTER USER ORACLE_OCM PROFILE MANH_NONADM;

ALTER USER APPQOSSYS PROFILE MANH_NONADM;

ALTER USER WMSYS PROFILE MANH_NONADM;

ALTER USER EXFSYS PROFILE MANH_NONADM;

-For the oracle text, do not apply

ALTER USER CTXSYS PROFILE MANH_APP;

-MGMT_VIEW used OEM Database control. Do not apply

ALTER USER MGMT_VIEW PROFILE MANH_APP;

-Used by the Manager of the company, do not apply

ALTER USER PROFILE MANH_APP DBSNMP.

-XDB stores metadata and data in Oracle XML DB. Do not apply

ALTER USER XDB PROFILE MANH_APP;

-ALTER USER XS$ PROFILE NULL MANH_NONADM;

ALTER USER PROFILE ANONYMOUS MANH_NONADM;

ALTER USER ORDPLUGINS PROFILE MANH_NONADM;

ALTER USER ORDSYS PROFILE MANH_NONADM;

ALTER USER ORDDATA PROFILE MANH_NONADM;

ALTER USER SI_INFORMTN_SCHEMA PROFILE MANH_NONADM;

ALTER USER MDSYS PROFILE MANH_NONADM;

ALTER USER OLAPSYS PROFILE MANH_NONADM;

ALTER USER MDDATA PROFILE MANH_NONADM;

ALTER USER SPATIAL_WFS_ADMIN_USR PROFILE MANH_NONADM;

ALTER USER SPATIAL_CSW_ADMIN_USR PROFILE MANH_NONADM;

ALTER USER APEX_PUBLIC_USER PROFILE MANH_NONADM;

ALTER USER FLOWS_FILES PROFILE MANH_NONADM;

ALTER USER APEX_030200 PROFILE MANH_NONADM;

ALTER USER OWBSYS PROFILE MANH_NONADM;

ALTER USER OWBSYS_AUDIT PROFILE MANH_NONADM;

-Change password

ALTER USER OUTLN IDENTIFIED BY uNani8987 #;

ALTER USER IDENTIFIED BY Hg DIP $ i9CLai;

ALTER USER ORACLE_OCM IDENTIFIED BY Hg$ i9CLak;

ALTER USER IDENTIFIED BY pR DBSNMP $ YeoT3i; -> This messed up Enterprise manager

ALTER USER IDENTIFIED BY pR APPQOSSYS $ YeoT3m;

ALTER USER WMSYS IDENTIFIED BY Hg$ i9CLna;

ALTER USER EXFSYS IDENTIFIED BY Hg$ i9CLnb;

ALTER USER CTXSYS IDENTIFIED BY Hg$ i9CLns;

EDIT ANONYMOUS USER IDENTIFIED BY Hg$ i9CLnc;

ALTER USER IDENTIFIED BY Hg XDB $ i9CLnd;

-ALTER USER XS$ NULL IDENTIFIED BY Hg$ i9CLne;

ALTER USER ORDPLUGINS IDENTIFIED BY Hg$ i9CLnaf;

ALTER USER ORDSYS IDENTIFIED BY Hg$ i9CLnag;

ALTER USER ORDDATA IDENTIFIED BY Hg$ i9CLnah;

ALTER USER IDENTIFIED BY pR SI_INFORMTN_SCHEMA $ YeoT3m;

ALTER USER MDSYS IDENTIFIED BY julsi8987 #;

ALTER USER IDENTIFIED BY pR OLAPSYS $ YeoT3w;

ALTER USER MDDATA IDENTIFIED BY uNani8987 #;

ALTER USER SPATIAL_WFS_ADMIN_USR IDENTIFIED BY Hg$ i9CLai;

ALTER USER SPATIAL_CSW_ADMIN_USR IDENTIFIED BY Hg$ i9CLak;

ALTER USER IDENTIFIED BY pR MGMT_VIEW $ YeoT3i;

ALTER USER IDENTIFIED BY UI APEX_PUBLIC_USER $ YeoT3m;

ALTER USER FLOWS_FILES IDENTIFIED BY Hg$ i9CLna;

ALTER USER APEX_030200 IDENTIFIED BY Hg$ i9CLnb;

ALTER USER OWBSYS IDENTIFIED BY Hg$ i9CLnb;

ALTER USER IDENTIFIED BY pR OWBSYS_AUDIT $ YeoT3s;

The script above was performed on one of our criticisms of production DBs. After this, Enterprise manager has stopped working because the default password of DBSNMP has changed. To solve this problem, password of DBSNMP must be changed in a special way as described in 259387.1

Now I fear that other DB features may not work if I change the password of users by default.

So, we want to know if it is safe to

1. change the password of the default DB users mentioned above?

2. change the user profile DB default DEFAULT value for a custom profile as shown above?

Max wrote:

Version of the grid: 11.2.0.4.0

RDBMS version: 11.2.0.4.0

Platform: Oracle Linux 6.4

To comply with upcoming security audit, we need all DB users except users of the application to conform to the password of our firm strategy.

Currently, all of our DB users belong to the DEFAULT profile which is not to impose restrictions such as the complexity of password, password expiration.

To implement password policy, I created 3 profiles and a password check the operation.

Here are the 3 profiles, that I introduce

MANH_ADM - for SYS, SYSTEM, SYSMAN users. Associated with a password check function that responds to the lack of policies of our firm.

MANH_NONADM - for users who were created by default when you create a new database. Associated with a password check the operation comply with the policies of our firm

MANH_APP - users for the Application. Very mild. No restrictions as requested by the team of apps. No associated password policy.

Here is an excerpt of the script we used to implement all our DBs It Security.

change the profile of these users to a custom profile named MANH_NONADM and changes the password for all users by default DB.

ALTER USER OUTLN PROFILE MANH_NONADM;

ALTER USER PROFILE MANH_NONADM DIP.

ALTER USER ORACLE_OCM PROFILE MANH_NONADM;

ALTER USER APPQOSSYS PROFILE MANH_NONADM;

ALTER USER WMSYS PROFILE MANH_NONADM;

ALTER USER EXFSYS PROFILE MANH_NONADM;

-For the oracle text, do not apply

ALTER USER CTXSYS PROFILE MANH_APP;

-MGMT_VIEW used OEM Database control. Do not apply

ALTER USER MGMT_VIEW PROFILE MANH_APP;

-Used by the Manager of the company, do not apply

ALTER USER PROFILE MANH_APP DBSNMP.

-XDB stores metadata and data in Oracle XML DB. Do not apply

ALTER USER XDB PROFILE MANH_APP;

-ALTER USER XS$ PROFILE NULL MANH_NONADM;

ALTER USER PROFILE ANONYMOUS MANH_NONADM;

ALTER USER ORDPLUGINS PROFILE MANH_NONADM;

ALTER USER ORDSYS PROFILE MANH_NONADM;

ALTER USER ORDDATA PROFILE MANH_NONADM;

ALTER USER SI_INFORMTN_SCHEMA PROFILE MANH_NONADM;

ALTER USER MDSYS PROFILE MANH_NONADM;

ALTER USER OLAPSYS PROFILE MANH_NONADM;

ALTER USER MDDATA PROFILE MANH_NONADM;

ALTER USER SPATIAL_WFS_ADMIN_USR PROFILE MANH_NONADM;

ALTER USER SPATIAL_CSW_ADMIN_USR PROFILE MANH_NONADM;

ALTER USER APEX_PUBLIC_USER PROFILE MANH_NONADM;

ALTER USER FLOWS_FILES PROFILE MANH_NONADM;

ALTER USER APEX_030200 PROFILE MANH_NONADM;

ALTER USER OWBSYS PROFILE MANH_NONADM;

ALTER USER OWBSYS_AUDIT PROFILE MANH_NONADM;

-Change password

ALTER USER OUTLN IDENTIFIED BY uNani8987 #;

ALTER USER IDENTIFIED BY Hg DIP $ i9CLai;

ALTER USER ORACLE_OCM IDENTIFIED BY Hg$ i9CLak;

ALTER USER IDENTIFIED BY pR DBSNMP $ YeoT3i; ---> This messed up Enterprise manager

ALTER USER IDENTIFIED BY pR APPQOSSYS $ YeoT3m;

ALTER USER WMSYS IDENTIFIED BY Hg$ i9CLna;

ALTER USER EXFSYS IDENTIFIED BY Hg$ i9CLnb;

ALTER USER CTXSYS IDENTIFIED BY Hg$ i9CLns;

EDIT ANONYMOUS USER IDENTIFIED BY Hg$ i9CLnc;

ALTER USER IDENTIFIED BY Hg XDB $ i9CLnd;

-ALTER USER XS$ NULL IDENTIFIED BY Hg$ i9CLne;

ALTER USER ORDPLUGINS IDENTIFIED BY Hg$ i9CLnaf;

ALTER USER ORDSYS IDENTIFIED BY Hg$ i9CLnag;

ALTER USER ORDDATA IDENTIFIED BY Hg$ i9CLnah;

ALTER USER IDENTIFIED BY pR SI_INFORMTN_SCHEMA $ YeoT3m;

ALTER USER MDSYS IDENTIFIED BY julsi8987 #;

ALTER USER IDENTIFIED BY pR OLAPSYS $ YeoT3w;

ALTER USER MDDATA IDENTIFIED BY uNani8987 #;

ALTER USER SPATIAL_WFS_ADMIN_USR IDENTIFIED BY Hg$ i9CLai;

ALTER USER SPATIAL_CSW_ADMIN_USR IDENTIFIED BY Hg$ i9CLak;

ALTER USER IDENTIFIED BY pR MGMT_VIEW $ YeoT3i;

ALTER USER IDENTIFIED BY UI APEX_PUBLIC_USER $ YeoT3m;

ALTER USER FLOWS_FILES IDENTIFIED BY Hg$ i9CLna;

ALTER USER APEX_030200 IDENTIFIED BY Hg$ i9CLnb;

ALTER USER OWBSYS IDENTIFIED BY Hg$ i9CLnb;

ALTER USER IDENTIFIED BY pR OWBSYS_AUDIT $ YeoT3s;

The script above was performed on one of our criticisms of production DBs. After this, Enterprise manager has stopped working because the default password of DBSNMP has changed. To solve this problem, password of DBSNMP must be changed in a special way as described in 259387.1

Now I fear that other DB features may not work if I change the password of users by default.

So, we want to know if it is safe to

1. change the password of the default DB users mentioned above?

2. change the user profile DB default DEFAULT value for a custom profile as shown above?

(1) as far as the database is concerned, EM is just another app, which just happens to connect with the credentials for DBSNMP.

(2) any process that connects to the database must know what username and password to use for this connection.

(3) any process that connects to the database (EM, or YOUR_CORPORATE_APP or sitting in front of a keyboard) necessarily must keep their passwords somewhere - in your head, the sticky notes stuck on screen (practical baaad), in a text file and in the case of the MA, in an xml file.

(4) so whenever you change a password, the process that uses this password needs to know what the password is, and store it in all repository it uses for this purpose.  That's what note ml, tell you how and where to put the new password in the repository that MS uses to remember his password.

(5) therefore the same principle will apply to all other user accounts.  If you (or a process on your behalf) changes a password, you (or some process on your behalf) should inform the user in a manner in which the user can understand and take the necessary measures.

If you change a password, you must inform the user.  Period.  Full stop.

And that's really what are the notes of ML SYSMAN and DBNSMP.  There is really nothing 'special' to their topic.  The processes that use these accounts (EM, or YOUR_CORPORATE_APP or sitting in front of a keyboard) keep their passwords somewhere - in your head, on sticky notes pasted (practical baaad) onscreen, in a text file and in the case of the MA, in an xml file.  So whenever you change a password, the process that uses this password needs to know what is the new password.

Tags: Database

Similar Questions

Maybe you are looking for

  • How can I fix the damaged file sql server database ME?

    Standby my mdf file got damage due to unknown reasons then I used the command dbcc chekcdb but it failed, file MDF is important to me, I don't ' know how to recover data from the mdf file. Please anyone suggest me?

  • Error code 80242016

    I tried several times to install Windows Vista Service Pack 2 and every time I get the same error code 8024016.  There is space enough and did not cancel them before updates have been made.  Can anyone please help me out and let me know what I can do

  • "Windows needs to install driver software for your Internet access server.

    Hello everyone, since April 3, 2010 I get this message just after I turn on the computer and Vista SP2 is ready to ROCK, I change my router in 31 March, for a Lynksis E1000 and it works perfectly since then. Now, in the cry of the message I have diff

  • Cannot restore to Windows 7 from Windows 10

    * Original title: update windows 7 As windows 10 insists to upgrade windows 7. As I don't want. Finally, it was destroyed. I have reinstall my purchase DVD of windows 7 again. noway I can't update. even I tried all Microsoft solutions. Is is a way to

  • Error 1722 (Borderlands)

    Allora io non riesco installare he gioco Borderlands sul mio pc (windows 7). Prima mi dava error 1721, sono riuscito a sistemarlo my adesso mi da error 1722. Che cosa posso fare?